CVE-2022-3949

LOW

Simple Cashiering System - Cross-Site Scripting via User Account Handler Fullname Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-3949. PoCs published by maikroservice.

AI-analyzed exploit summary This repository provides a detailed technical writeup on CVE-2022-3949, a stored XSS vulnerability in Simple Cashiering System. It includes reproduction steps, screenshots, and explains the impact of session hijacking due to missing HttpOnly cookie flags.

Description

A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of the component User Account Handler. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-213455.

Exploits (1)

nomisec WRITEUP 1 stars
by maikroservice · poc
https://github.com/maikroservice/CVE-2022-3949

This repository provides a detailed technical writeup on CVE-2022-3949, a stored XSS vulnerability in Simple Cashiering System. It includes reproduction steps, screenshots, and explains the impact of session hijacking due to missing HttpOnly cookie flags.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Simple Cashiering System (PHP/SQLite)
Auth required
Prerequisites: Access to a user account in the Simple Cashiering System · Admin user must visit the user or sales tab
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (1)

Core 1
Core References
Third Party Advisory
https://vuldb.com/?id.213455

Scores

CVSS v3 3.5
EPSS 0.0049
EPSS Percentile 38.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-707
Status published
Products (1)
simple_cashiering_system_project/simple_cashiering_system 1.0
Published Nov 11, 2022
Tracked Since Feb 18, 2026